In Google Security Operations SOAR, native dashboard queries allow for the visualization of custom metrics, such as case counts and SLA compliance, using widgets like bar charts, pie charts, and tables. Users can create custom dashboards, configure widget filters by time range or SOC environment, and display up to 12 widgets.
Key Aspects of SOAR Native Dashboard Queries
- Creation & Access: Navigate to Dashboards & Reports > SOAR Dashboards to create, view, and share custom dashboards.
- Query Structure: Data can be queried for specific metrics, such as tracking active cases, SLA metrics (met/exceeded), or specific incident types.
- Widget Customization: Widgets can be added, rearranged, and edited (using the cog icon) to display data in various formats.
- Data Types: Common widgets show data regarding case occurrence time, incident severity, and user assignments.
- Interactivity: Users can click on widget graphics to drill down into specific incident details.
For detailed configuration, users can define metrics like $total = count($playbookDisplayName) within the query, allowing for detailed tracking of playbook or case metrics.